curious--is anybody actually using OpenID or is it like one of those things everyone promotes publicly on principle (like feeding hungry kids in 3rd world countries) but ignores privately?
I'd heard of it before, but I really discovered it when we were implementing it for microPledge. Anyway, I signed up with MyOpenID -- and yeah, I'll use it for sign-ups from now on (if the website in question supports it).
In the sense that a rogue site can pretend to support openid, but actually present a copy of the openid provider's site, yes. People just have to be careful to check the domain name and SSL cert, just like everywhere else.
Wordpress.com has an interesting way of handling this; when you use your wordpress.com openid, it doesn't let you log in from the page you get redirected to. You have to manually go to the front page by typing in the address, log in there, and then continue. It's annoying, but probably patches the hole.
I like the idea but I dot believe it will work. Major players (Amazon, Google, Yahoo, Microsoft) are NOT interested in open standards for their user authentication. This is why Microsoft Passport failed and this is why Google Checkout will fail and OpenID will follow their "lead".
